Over the weekend an internet-facing DI-624 router of mine was e-mailing me logs like crazy for some reason. Normally it's a few a day, but it was about one every few minutes instead. Analyzing the messages, I found that only 340 had the same src and dst port number, whereas the majority of "default deny" dropped packets (28,000+) had the two ports different. What does this mean?
|
feedback
|
|
Source ports and destination ports are normally going to be different. This is normal. When you connect to web site as a client to destination port 80, the OS will likely give the packet a high number source port that is maybe random. Go read about Ephemeral Ports. This aids in the OS keeping track of which session is which. | |||
feedback
|
